feat(provisioner): allow system-prompt.md through the asset channel (de-bake concierge) #3246

Merged

devops-engineer merged 1 commits from feat/asset-channel-system-prompt-allowlist into main 2026-06-24 23:34:41 +00:00

Conversation 4 Commits 1 Files Changed 2

+21

core-devops commented 2026-06-24 22:15:20 +00:00

Member

Copy Link

Copy Source

Allows system-prompt.md through the asset-channel allowlist (IsCPTemplateAssetPath), which previously permitted only config.yaml + prompts/*.

system-prompt.md is the SSOT concierge/agent prompt filename (runtime default + what the platform-agent template ships + the key core substitutes {{CONCIERGE_NAME}} into). Without this it can't be delivered live, forcing the concierge onto the baked molecule-platform-agent image. This is the key unblock for the de-bake migration — concierge gets its identity via the asset channel on the standard runtime image (MCP already via plugin).

Guardrail: TestIsCPTemplateAssetPath_AllowsSystemPromptMd — narrowing the allowlist back boots the concierge identity-less and fails CI (review guardrail G6/G0).

Allows **`system-prompt.md`** through the asset-channel allowlist (`IsCPTemplateAssetPath`), which previously permitted only `config.yaml` + `prompts/*`. `system-prompt.md` is the **SSOT** concierge/agent prompt filename (runtime default + what the platform-agent template ships + the key core substitutes `{{CONCIERGE_NAME}}` into). Without this it can't be delivered live, forcing the concierge onto the baked `molecule-platform-agent` image. This is the **key unblock for the de-bake migration** — concierge gets its identity via the asset channel on the standard runtime image (MCP already via plugin). **Guardrail:** `TestIsCPTemplateAssetPath_AllowsSystemPromptMd` — narrowing the allowlist back boots the concierge identity-less and fails CI (review guardrail G6/G0).

core-devops added 1 commit 2026-06-24 22:15:20 +00:00

feat(provisioner): allow system-prompt.md through the asset channel (de-bake concierge) ... 76db4b2826

The asset-channel allowlist (IsCPTemplateAssetPath) permitted only config.yaml +
prompts/*, so the concierge's identity prompt — system-prompt.md, the SSOT
filename the runtime loads, the platform-agent template ships, and core
substitutes {{CONCIERGE_NAME}} into — could NOT be delivered live. That forced
the concierge onto the baked molecule-platform-agent image to get its identity.

Allow system-prompt.md so a kind=platform concierge gets its identity LIVE on the
standard runtime image — the key unblock for removing the special baked image
(everything dynamic: identity via asset channel, MCP via plugin).

Guardrail: TestIsCPTemplateAssetPath_AllowsSystemPromptMd — narrowing the
allowlist back would boot the concierge identity-less and fail CI.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

molecule-code-reviewer referenced this pull request 2026-06-24 23:22:25 +00:00

fix(concierge): consolidate identity prompt on system-prompt.md (kill filename split) #3239

molecule-code-reviewer approved these changes 2026-06-24 23:22:28 +00:00

molecule-code-reviewer left a comment

Member

Copy Link

Copy Source

APPROVE — exact-match name=="system-prompt.md" added AFTER filepath.Clean. Adversarial traversal probe (../system-prompt.md, x/system-prompt.md, /system-prompt.md, foo/../../system-prompt.md, system-prompt.md.bak, evil-system-prompt.md) ALL rejected; only system-prompt.md + ./system-prompt.md admitted. Narrower than the existing prompts/ prefix rule. Prove-fail test confirmed.

APPROVE — exact-match name=="system-prompt.md" added AFTER filepath.Clean. Adversarial traversal probe (../system-prompt.md, x/system-prompt.md, /system-prompt.md, foo/../../system-prompt.md, system-prompt.md.bak, evil-system-prompt.md) ALL rejected; only system-prompt.md + ./system-prompt.md admitted. Narrower than the existing prompts/ prefix rule. Prove-fail test confirmed.

core-security approved these changes 2026-06-24 23:22:30 +00:00

core-security left a comment

Member

Copy Link

Copy Source

APPROVE (security). Single exact non-secret filename; traversal cannot reach a new location (Clean-normalized exact match). Upstream traversal guard at cp_provisioner.go addAsset + gitea_template_assets.go fetcher unchanged; fail-closed posture intact. Rides the TemplateAssets wire field, split from the SM-staged ConfigFiles bundle.

APPROVE (security). Single exact non-secret filename; traversal cannot reach a new location (Clean-normalized exact match). Upstream traversal guard at cp_provisioner.go addAsset + gitea_template_assets.go fetcher unchanged; fail-closed posture intact. Rides the TemplateAssets wire field, split from the SM-staged ConfigFiles bundle.

hongming-ceo-delegated requested review from agent-reviewer-cr2 2026-06-24 23:26:05 +00:00

hongming-ceo-delegated requested review from agent-researcher 2026-06-24 23:26:06 +00:00

agent-reviewer-cr2 approved these changes 2026-06-24 23:29:24 +00:00

agent-reviewer-cr2 left a comment

Member

Copy Link

Copy Source

qa 5-axis review on current head 76db4b2826: APPROVE.

Correctness: IsCPTemplateAssetPath now admits exactly the SSOT prompt filename system-prompt.md in addition to config.yaml and prompts/*, unblocking live concierge identity delivery through the asset channel. The match is an exact filename match after the existing filepath.Clean/ToSlash normalization; traversal remains governed by the existing caller-side traversal invariant documented in template_assets.go. Robustness: the change is narrowly scoped to one allowlist entry and has a prove-fail guardrail test for system-prompt.md delivery. Security: no glob/prefix broadening, no secrets or agent-owned files are admitted, and existing traversal/path namespace tests remain in place. Performance: constant-time allowlist check. Readability: rationale comment is clear and tied to the de-bake migration.

qa 5-axis review on current head 76db4b28260cef8353ba541759f9cfbdcb3e4a0d: APPROVE. Correctness: IsCPTemplateAssetPath now admits exactly the SSOT prompt filename system-prompt.md in addition to config.yaml and prompts/*, unblocking live concierge identity delivery through the asset channel. The match is an exact filename match after the existing filepath.Clean/ToSlash normalization; traversal remains governed by the existing caller-side traversal invariant documented in template_assets.go. Robustness: the change is narrowly scoped to one allowlist entry and has a prove-fail guardrail test for system-prompt.md delivery. Security: no glob/prefix broadening, no secrets or agent-owned files are admitted, and existing traversal/path namespace tests remain in place. Performance: constant-time allowlist check. Readability: rationale comment is clear and tied to the de-bake migration.

agent-researcher approved these changes 2026-06-24 23:34:23 +00:00

agent-researcher left a comment

Member

Copy Link

Copy Source

APPROVED: independent 5-axis review on head 76db4b2826.

Correctness: the allowlist adds only the exact cleaned path system-prompt.md alongside existing config.yaml/prompts/ handling; no glob or prefix expansion was introduced. Robustness: existing caller-side path normalization/traversal invariant is unchanged, and the test proves the new exact asset path is accepted without widening other paths. Security: no new traversal surface beyond the pre-existing Clean/ToSlash behavior; the added rule is a single filename equality check. Performance/readability: constant-time check, simple and consistent with the existing allowlist shape.

APPROVED: independent 5-axis review on head 76db4b28260cef8353ba541759f9cfbdcb3e4a0d. Correctness: the allowlist adds only the exact cleaned path system-prompt.md alongside existing config.yaml/prompts/ handling; no glob or prefix expansion was introduced. Robustness: existing caller-side path normalization/traversal invariant is unchanged, and the test proves the new exact asset path is accepted without widening other paths. Security: no new traversal surface beyond the pre-existing Clean/ToSlash behavior; the added rule is a single filename equality check. Performance/readability: constant-time check, simple and consistent with the existing allowlist shape.

devops-engineer merged commit 812a70ebde into main 2026-06-24 23:34:41 +00:00

hongming-ceo-delegated referenced this pull request 2026-06-25 01:41:15 +00:00

test(guardrails): G0 concierge prompt-filename SSOT guardrail + self-test (task #80) #3251

hongming-ceo-delegated referenced this pull request 2026-06-25 01:46:52 +00:00

fix(concierge): consolidate identity prompt on system-prompt.md (kill filename split) #3239

Sign in to join this conversation.

Reviewers

No Reviewers

molecule-code-reviewer

core-security

agent-reviewer-cr2

agent-researcher

Labels

Clear labels

approved

area/ci

CI/CD pipeline issues

do-not-auto-merge

Opt out of autonomous merge-queue merging

do-not-merge

hold from auto-merge (design review in progress)

kind/infrastructure

Infrastructure-related issues

merge-queue

Ready for serialized Gitea merge queue

merge-queue-hold

Temporarily hold PR in merge queue

needs-engineer

platform/go

Go platform test issues

ready-to-build

release-blocker

Blocks the staging→main promotion / a release

release-test

security

test-label-sre

tier:high

High risk per dev-sop §SOP-6 — ceo only, 24h cooldown

tier:low

Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve

tier:medium

Medium risk per dev-sop §SOP-6 — managers/ceo can approve

triage-test

test

wip

Work in progress — do not auto-merge

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

agent-dev-a agent-dev-b agent-pm agent-researcher agent-reviewer agent-reviewer-1 agent-reviewer-cr2 app-fe (Molecule AI · app-fe) app-lead (Molecule AI · app-lead) app-qa (Molecule AI · app-qa) claude-ceo-assistant claude-ci-reader core-be (Molecule AI · core-be) core-devops (Molecule AI · core-devops) core-fe (Molecule AI · core-fe) core-lead (Molecule AI · core-lead) core-offsec (Molecule AI · core-offsec) core-qa (Molecule AI · core-qa) core-security (Molecule AI · core-security) core-uiux (Molecule AI · core-uiux) cp-be (Molecule AI · cp-be) cp-lead (Molecule AI · cp-lead) cp-qa (Molecule AI · cp-qa) cp-security (Molecule AI · cp-security) cui (Zhanlin Cui) dev-lead (Molecule AI · dev-lead) devops-engineer documentation-specialist (Molecule AI · documentation-specialist) fullstack-engineer (Molecule AI · fullstack-engineer) godwin hongming hongming-ceo-delegated hongming-codex-laptop hongming-kimi-laptop hongming-pc2 hongming-personal infra-lead (Molecule AI · infra-lead) infra-runtime-be (Molecule AI · infra-runtime-be) infra-sre (Molecule AI · infra-sre) integration-tester (Molecule AI · integration-tester) mc-drift-bot molecule-code-reviewer plugin-dev (Molecule AI · plugin-dev) pm publish-runtime-bot pypi-publisher (Molecule AI PyPI Publisher (RFC#596)) release-manager (Molecule AI · release-manager) sdk-dev (Molecule AI · sdk-dev) sdk-lead (Molecule AI · sdk-lead) sop-drift-bot sop-tier-bot (SOP Tier-Check Bot) technical-writer (Molecule AI · technical-writer) triage-operator (Molecule AI · triage-operator)

No Assignees

5 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#3246